This adds the ask sub-directive to tls that defines the URL of a backend HTTP service to be queried during the TLS handshake to determine if an on-demand TLS certificate should be acquired for incoming hostnames. When the ask sub-directive is defined, Caddy will query the URL for permission to acquire a cert by making a HTTP GET request to the URL including the requested domain in the query string. If the backend service returns a 2xx response Caddy will acquire a cert. Any other response code (including 3xx redirects) are be considered a rejection and the certificate will not be acquired.

* Update build instruction

This changes add proper an easy instruction for building.

* Update README.md

The rc.subr framework already takes care of substituting user. So, using
daemon's -u option is double user-substitution and fails if $caddy_user
is non-root.

caddy.go:569: could be simplified

sigtrap_posix.go:87: value of inst is never used

upgrade.go:151: should omit nil check; len() for nil slices is defined as zero

Changes the log output of on startup

* Handle the case of an OCSP responder certificate expiring before an OCSP response it issued

* oops

* doh, gofmt

A default of true is risky when protecting assets by matching base path.
It's not obvious that protecting /foo/ will allow /Foo/ through, and if
accessing static files on a case-insensitive file system... that's no
good. So the default is now to be case-INsensitive when matching paths.

Provides a new hook for plugins as a means to provide the current caddy.Instance when starting or restarting.

* Implement 'command' plugin

* Rename 'command' to 'on'

* Split this PR

This allows you to have multiple redir directives conditioned solely
upon if statements, without regard to path.

I am not a lawyer, but according to the appendix of the license,
these boilerplate notices should be included with every source file.

When two Caddyfiles with the same name, but different paths, are
imported, it can cause a weird bug because isNewLine() returned false
when it should return true, since the files are actually different,
but it couldn't know that because only the base name was stored,
not the whole path.

Signed-off-by: Tw <tw19881113@gmail.com>